Hardware Trojan Detection Research Articles

Conventional and machine learning approaches as countermeasures against hardware trojan attacks

Every year, the rate at which technology is applied on areas of our everyday life is increasing at a steady pace. This rapid development drives the technology companies to design and fabricate their integrated circuits (ICs) in non-trustworthy outsourcing foundries to reduce the cost, thus, leaving space for a synchronous form of virus, known as Hardware Trojan (HT), to be developed. HTs leak encrypted information, degrade device performance or lead to total destruction. To reduce the risks associated with these viruses, various approaches have been developed aiming to prevent and detect them, based on conventional or machine learning methods. Ideally, any undesired modification made to an IC should be detectable by pre-silicon verification/simulation and post-silicon testing. The infected circuit can be inserted in different stages of the manufacturing process, rendering the detection of HTs a complicated procedure. In this paper, we present a comprehensive review of research dedicated to countermeasures against HTs embedded into ICs. The literature is grouped in four main categories; (a) conventional HT detection approaches, (b) machine learning for HT countermeasures, (c) design for security and (d) runtime monitor.

Ten years of hardware Trojans: a survey from the attacker's perspective

Hardware Trojan detection techniques have been studied extensively. However, to develop reliable and effective defenses, it is important to figure out how hardware Trojans are implemented in practical scenarios. The authors attempt to make a review of the hardware Trojan design and implementations in the last decade and also provide an outlook. Unlike all previous surveys that discuss Trojans from the defender's perspective, for the first time, the authors study the Trojans from the attacker's perspective, focusing on the attacker's methods, capabilities, and challenges when the attacker designs and implements a hardware Trojan. First, the authors present adversarial models in terms of the adversary's methods, adversary's capabilities, and adversary's challenges in seven practical hardware Trojan implementation scenarios: in-house design team attacks, third-party intellectual property vendor attacks, computer-aided design tools attacks, fabrication stage attacks, testing stage attacks, distribution stage attacks, and field-programmable gate array Trojan attacks. Second, the authors analyse the hardware Trojan implementation methods under each adversarial model in terms of seven aspects/metrics: hardware Trojan attack scenarios, the attacker's motivation, feasibility, detectability (anti-detection capability), protection and prevention suggestions for the designer, overhead analysis, and case studies of Trojan implementations. Finally, future directions on hardware Trojan attacks and defenses are also discussed.

FPGA Realization of Deep Neural Network for Hardware Trojan Detection

With the increase in outsourcing design and fabrication, malicious third-party vendors often insert hardware Trojan (HT) in the integrated Circuits(IC). It is difficult to identify these Trojans since the nature and characteristics of each Trojan differ significantly. Any method developed for HT detection is limited by its capacity on dealing with varied types of Trojans. The main purpose of this study is to show using deep learning (DL), this problem can be dealt with some extent and the effect of deep neural network (DNN) when it is realized on field programmable gate array (FPGA). In this paper, we propose a comparison of accuracy in finding faults on ISCAS’85 benchmark circuits between random forest classifier and DNN. Further for the faster processing time and less power consumption, the network is implemented on FPGA. The results show the performance of deep neural network gets better when a large number of nets are used and faster in the execution of the algorithm. Also, the speedup of the neuron is 100x times better when implemented on FPGA with 15.32% of resource utilization and provides less power consumption than GPU.

A Framework for Hardware Trojan Vulnerability Estimation and Localization in RTL Designs

As the design complexity increases, the attack space for malicious modifications in the design also increases. Attackers in untrusted phases during the Integrated Circuit (IC) design cycle may embed a Hardware Trojan (HT). A potential and stealthy HT is triggered with nets that rarely switch during regular circuit operation. Detection of HT in the host design requires exhaustive simulation to activate the HT during pre- and post-silicon. For analyzing HT vulnerability, we present a modeling approach to capture the rare nets using word-level statistics of the inputs. It provides the capability to locate macro-block(s) in a Register Transfer Level (RTL) design to estimate the rare triggering nets. Given RTL description of a design, we decompose the design into a subset of basic arithmetic modules, each of which is pre-characterized (empirically and analytically) by which we evaluate the design for quick estimation of HT vulnerable macro-block(s). The relative impact of mapping the design to a particular module from its analytical characteristics can be used to detect “low activity” and “local regions” without expensive low-level simulation. We implement the model over a wide range of input signal statistics for Digital Signal Processing (DSP) Intellectual Property (IP) cores, and the average estimation error for different bit-widths and correlations is less than 2%. We also propose cost functions during mapping and show that identification of rare activity blocks (nets) at a higher level is closely related to the simulation results. The final mapping that identifies the candidate arithmetic modules can minimize HT vulnerability in design at the cost of accuracy.

DANA Universal Dataflow Analysis for Gate-Level Netlist Reverse Engineering

Reverse engineering of integrated circuits, i.e., understanding the internals of Integrated Circuits (ICs), is required for many benign and malicious applications. Examples of the former are detection of patent infringements, hardware Trojans or Intellectual Property (IP)-theft, as well as interface recovery and defect analysis, while malicious applications include IP-theft and finding insertion points for hardware Trojans. However, regardless of the application, the reverse engineer initially starts with a large unstructured netlist, forming an incomprehensible sea of gates.This work presents DANA, a generic, technology-agnostic, and fully automated dataflow analysis methodology for flattened gate-level netlists. By analyzing the flow of data between individual Flip Flops (FFs), DANA recovers high-level registers. The key idea behind DANA is to combine independent metrics based on structural and control information with a powerful automated architecture. Notably, DANA works without any thresholds, scenario-dependent parameters, or other “magic” values that the user must choose. We evaluate DANA on nine modern hardware designs, ranging from cryptographic co-processors, over CPUs, to the OpenTitan, a stateof- the-art System-on-Chip (SoC), which is maintained by the lowRISC initiative with supporting industry partners like Google and Western Digital. Our results demonstrate almost perfect recovery of registers for all case studies, regardless whether they were synthesized as FPGA or ASIC netlists. Furthermore, we explore two applications for dataflow analysis: we show that the raw output of DANA often already allows to identify crucial components and high-level architecture features and also demonstrate its applicability for detecting simple hardware Trojans.Hence, DANA can be applied universally as the first step when investigating unknown netlists and provides major guidance for human analysts by structuring and condensing the otherwise incomprehensible sea of gates. Our implementation of DANA and all synthesized netlists are available as open source on GitHub.

Graph‐based approach towards hardware Trojan vulnerability analysis

The author proposes an incremental windowing technique based on graph technique to detect hardware Trojan triggering signal. First, they analyse the switching activity file generated during simulation. Then, based on the window size of choice, they extract paths of n-HT (n-hardware Trojan; n is the number of triggering signals) and compare the path information with the HT instances from HT database to determine HTs' earliest/farthest activation time. They experiment with the incremental windowing technique on 420 combinational HT instances for four combinational designs. The results indicate that small and stealthy HT is active for a limited set of the time window and the number of test patterns during these windows is compact instead of exhaustive traditional random vector based Automatic Test Pattern Generation (ATPG).

He-ion Beam Imaging for Accurate Hardware Trojan Detection

An abstract is not available for this content so a preview has been provided. As you have access to this content, a full PDF is available via the ‘Save PDF’ action button.

A machine learning based golden-free detection method for command-activated hardware Trojan

Hardware Trojan detection has been becoming an attentive research subject since the first Trojan in real-world hardware was found. A common way to activate a hardware Trojan is to send a command, and detecting those command-activated Trojan is one of the significant dimensions in securing hardware. In this paper, we propose a novel chip-free detection method, called Pruning Bytes Command Search (PBCS), which is a machine learning-based approach and can efficiently find out command-activate hardware Trojans. The proposed PBCS has been evaluated in experimental environments (via micro-controller) and real-world validations (on smart cards). Our approach also combines with novelty detection and outlier detection methods and examines effects on One-Class Support Vector Machine, Local Outlier Factor, and Isolation Forest as distinguishers in five scenes, respectively. The findings of the evaluation show that our approach is competent for searching unknown commands. Accuracy performance can be enhanced when proper distinguishers are selected. The results demonstrate that PBCS can successfully find out all executable commands in an uncertain parsing path hardware, which implies our approach is applicable in the complicated context.

Near-Field Backscattering-Based Sensing for Hardware Trojan Detection

This article presents the near-field measurement setup and the sensor topology used to measure the backscattered signal from a small spot of $\sim 1$ mm on an FPGA to enable hardware Trojan (HT) detection. The novel sensor topology used in the setup contains a combination of $E$ - and $H$ -field probes with a tip diameter of 0.2 mm, which is used to excite a carrier and receive the modulated scattered signal that carries a signature of the inspected logic circuit. As a proof of concept and to develop insight, an EM-circuit co-simulation is presented to show that the received signal contains a signature of the logic circuit under test, which is imprinted on the relative power levels of the modulated scattered clock harmonics. The received modulated scattering signature was successfully used to detect the presence of an HT in the original circuit with 100% accuracy without false positives. The effects of using $E$ - and $H$ -field probes in very close proximity, such as resolution and mutual coupling, are analyzed and discussed. It is shown that there is a 12% decrease in resolution and less than 0.01 dB impact on invasiveness. The frequency band of operation for the measurement setup is 3–5 GHz. The probe combination is shown to have a spot size of ~1 mm, a coupling isolation better than 20 dB over the whole band and 30 dB for the design frequency.

Enhancing Hardware Trojan Detection Sensitivity Using Partition-Based Shuffling Scheme

This brief presents a new test pattern generation scheme alongside a design for trust (DfTr) methodology for detecting hardware Trojan through side channel-based analysis approaches. The proposed scheme takes advantage of the proposed Hamming distance-based reordering and partition-based shuffling methods. The key idea behind the proposed work is that instead of distributing the circuit activity profile among all the nets with low transition probability at once, it can only be restricted to the smaller subsets of rare nets one at a time, while the rest of subsets remain at the lowest activity. As a result, a remarkable reduction in the background circuit activity by more than 41% and favorable enhancement of detection sensitivity about 31% are achieved compared to the state-of-the-art method.

Combining Thermal Maps With Inception Neural Networks for Hardware Trojan Detection

Hardware Trojan detection on modern integrated circuits (ICs) is a challenging task since the inspector may have no idea about the location and size of the embedded Trojan circuit. To achieve an accurate Trojan detection, instead of relying on hardware reverse engineering, a nondestructive technique based on thermal maps and inception neural networks (INNs) is proposed in this letter. The thermal maps generated by a Trojan-free (TF) IC chip and multiple emulated Trojan-infected (TI) IC chips are collected and optimized as the critical side-channel leakages at first. Then, INNs are utilized to analyze these optimized thermal maps to exactly extract the information of the embedded Trojans under the assistance of customized filters. As shown in the results, after training the INNs with 150 000 thermal maps, the corresponding Trojan detection accuracy can be achieved over 98.2%.

PODEM: A low-cost property-based design modification for detecting Hardware Trojans in resource-constraint IoT devices

With the rapid growth in design and fabrication outsourcing in semiconductor industry, concerns have increased about insuring the trustworthiness of underlying hardware, commonly known as hardware Trojans. This paper presents a new low-cost and high-speed design for trust methodology (DfTr) to detect hardware Trojans, especially for resource-constraint IoT devices. To relieve the stealthy nature of Trojans, the full controllable paths are created between the low transition probability nets and the primary inputs. The key idea is that instead of specifying the full controllable paths based on minimum logical depth, one can alternatively specify the paths with the aim of achieving minimum number of insertion-points to lower the area overhead in devices with limited hardware resources. Accordingly, this paper develops a formal Property-based design modification mechanism, called PODEM, targeting different objective functions so as to lower the area overhead as well as augmenting the hardware Trojan detection sensitivity. The experimental results on different benchmark circuits show that the number of required insertion-points for the proposed methodology is favorably decreased around 28% compared with the state-of-the-art method. In addition to the lower area and delay overheads, the side channel detection sensitivity of the proposed approach is also augmented about 11.5%, on average, thanks to the considerable reduction of 18.7% in the background circuit activity.

SIMCom: Statistical sniffing of inter-module communications for runtime hardware trojan detection

Timely detection of Hardware Trojans (HTs) has become a major challenge for secure integrated circuits. We present a run-time methodology for HT detection that employs a multi-parameter statistical traffic modeling of the communication channel in a given System-on-Chip (SoC), named as SIMCom. The main idea is to model the communication using multiple side-channel information like the Hurst exponent, the standard deviation of the injection distribution, and the hop distribution jointly to accurately identify HT-based online anomalies (that affects the communication without affecting the protocols or control signals). At design time, our methodology employs a “property specification language” to define and embed assertions in the RTL, specifying the correct communication behavior of a given SoC. At run-time, it monitors the anomalies in the communication behavior by checking the execution patterns against these assertions. For illustration, we evaluate SIMCom for three SoCs, i.e., SoC1 (four single-core MC8051 and UART modules), SoC2 (four single-core MC8051, AES, ethernet, memctrl, BasicRSA, RS232 modules), and SoC3 (four single-core LEON3 connected with each other and AES, ethernet, memctrl, BasicRSA, RS23s modules microcontrollers). The experimental results show that with the combined analysis of multiple statistical parameters, SIMCom is able to detect all the benchmark Trojans (available on trust-hub) with less than 1% area and power overhead.

Securing IoT Space via Hardware Trojan Detection

Hardware Trojan (HT) is a malicious modification in the chip circuitry, which may lead to undesired chip function changing or sensitive information leaking once activated. As recently studied, HT has become one of the main threats for Internet-of-Things (IoT) security, and therefore, protecting IoT against the HT attack attracts growing attention from IoT researchers. In this article, we propose an HT detection technique which makes use of chip temporal thermal information and self-organizing map (SOM) neural network to automatically isolate the Trojan-infected chips with the Trojan-free ones, and meanwhile, confirm the Trojan location at the infected chips. The experimental results reveal that our method is effective. Specifically, for the Trust-hub benchmarks, it can detect HTs which increase only 0.02% power consumption of the original design and localize the Trojan positions precisely without any error. In addition, we demonstrate the advantages of our method over two existing HT detection methods, namely, the thermal and power map (TPM) and ring oscillator net (RON), and make a thorough discussion on how the thermal image resolution, chip technology, and clustering algorithm affect the Trojan detection results.

Hardware Trojan Detection Using Backside Optical Imaging

The high cost of integrated circuit chip production has driven more and more chip design companies to use overseas production services. Since the integrated circuit production cannot be closely monitored, the security of integrated circuit chips has become a major concern. Hardware Trojan (HT) insertion is one type of the hardware attack. HTs are extremely stealthy due to their small sizes and low triggering rates. HTs inserted during manufacturing can have minimum impact on the timing and power. In fact, this impact can be smaller than the timing and power variations caused by the process variations. Therefore, these HTs cannot be easily detected using traditional electrical methods. In this article, we propose a novel optical method, where we image the integrated circuit chip from the backside. Our method, can easily detect any replacements, modifications, or rearrangements of fill cells or functional cells for HT insertion. We use a noise-based detection method to achieve high HT detection rates in different testbenches. To further improve the robustness of our method, we strategically place high reflectance fill cells in the designs. Our approach provides high-resolution, nondestructive, and rapid means to detect HTs inserted during fabrication. We evaluate our approach using various hardware blocks where the HTs can occupy less than 0.1% of the total area or consist of fewer than three gates. In addition, we analyze our method with various magnitudes of noise, process variations, detection window sizes, and resolutions.

A Study of Machine Learning based Hardware Trojans Detection Mechanisms for FPGAs

A Study of Machine Learning based Hardware Trojans Detection Mechanisms for FPGAs

Sensitivity analysis of testability parameters for secure IC design

Insertion of malicious circuits commonly known as Hardware Trojans into an original integrated circuit (IC) design to alter the functionality has been a major concern in recent years. As a result, over the years multiple techniques have been suggested by researchers to combat these malicious threats. Hard to test nets in any logic circuit are the most vulnerable to insertion of Hardware Trojans. Testability analysis is the process of identification of these hard to test nets in a logic circuit. Testability analysis is achieved through the testability metrics namely controllability and observability. Testability metrics can be used as a yardstick in devising efficient Hardware Trojan detection methods. The crux of this study is a novel method for identification of susceptible nets that are prone to Hardware Trojan insertions in a logic circuit. The study also presents a comprehensive analysis of the impact on testability parameters as a result of Hardware Trojans in the identified susceptible nets. The method utilises the testability parameters of nets to define threshold values for isolating susceptible nets in a design. The study details out the impact of the number of trigger inputs as well as the distribution of trigger nets on the testability metrics of digital circuits.

Graph Similarity and its Applications to Hardware Security

Hardware reverse engineering is a powerful and universal tool for both security engineers and adversaries. From a defensive perspective, it allows for detection of intellectual property infringements and hardware Trojans, while it simultaneously can be used for product piracy and malicious circuit manipulations. From a designer's perspective, it is crucial to have an estimate of the costs associated with reverse engineering, yet little is known about this, especially when dealing with obfuscated hardware. The contribution at hand provides new insights into this problem, based on algorithms with sound mathematical underpinnings. Our contributions are threefold: First, we present the graph similarity problem for automating hardware reverse engineering. To this end, we improve several state-of-the-art graph similarity heuristics with optimizations tailored to the hardware context. Second, we propose a novel algorithm based on multiresolutional spectral analysis of adjacency matrices. Third, in three extensively evaluated case studies, namely (1) gate-level netlist reverse engineering, (2) hardware Trojan detection, and (3) assessment of hardware obfuscation, we demonstrate the practical nature of graph similarity algorithms.

HTDet: A clustering method using information entropy for hardware Trojan detection

Hardware Trojans (HTs) have drawn increasing attention in both academia and industry because of their significant potential threat. In this paper, we propose HTDet, a novel HT detection method using information entropy-based clustering. To maintain high concealment, HTs are usually inserted in the regions with low controllability and low observability, which will result in that Trojan logics have extremely low transitions during the simulation. This implies that the regions with the low transitions will provide much more abundant and more important information for HT detection. The HTDet applies information theory technology and a density-based clustering algorithm called Density-Based Spatial Clustering of Applications with Noise (DBSCAN) to detect all suspicious Trojan logics in the circuit under detection. The DBSCAN is an unsupervised learning algorithm, that can improve the applicability of HTDet. In addition, we develop a heuristic test pattern generation method using mutual information to increase the transitions of suspicious Trojan logics. Experiments on circuit benchmarks demonstrate the effectiveness of HTDet.

On the feasibility of using evolvable hardware for hardware Trojan detection and prevention

Evolvable hardware (EH) architectures are capable of changing their configuration and behavior dynamically based on inputs from the environment. In this paper, we investigate the feasibility of using EH to prevent Hardware Trojan Horses (HTHs) from being inserted, activated, or propagated in a digital electronic chip. HTHs are malicious hardware components that intend to leak secret information or cause malfunctioning at run-time in the chip in which they are integrated. We hypothesize that EH can detect internal circuit errors at run-time and reconfigure to a state in which the errors are no longer present. We implement a Virtual Reconfigurable Circuit (VRC) on a Field-Programmable Gate Array (FPGA) that autonomously and periodically reconfigures itself based on an Evolutionary Algorithm (EA). New VRC configurations are generated with an on-chip EA engine.We show that the presented approach is applicable in a scenario in which (1) the HTH-critical areas in the circuit are known in advance, and (2) the VRC is a purely combinatorial circuit, as opposed to the on-chip memory holding the golden reference, which requires one or more cycles to be read/written. We compare two different approaches for protecting the system against HTHs: Genetic Programming (GP) and Cartesian Genetic Programming (CGP). The paper reports on experiments on four benchmark circuits and gives an overview of both the limitations and the added value of the presented approaches.